What we collect, and why.

What we store

• Account holders: your email address, a scrypt hash of your password (never the password itself), the time you activated, and your open sign-in sessions.
• Triumvir AI usage: a daily count of your requests and their estimated cost, used only to enforce your daily limit. We do not keep a log of your prompts or answers.
• Waitlist & inquiries: for the waitlist, your email and the time you joined; for an enterprise inquiry, your name, company, email and message.
• Server logs: standard web-server logs (IP address, browser type, page requested, time) kept for security and reliability. They rotate automatically and older entries are discarded, typically within a few weeks. Request bodies, prompts and passwords are never logged.
• Usage statistics: we count page views, key steps such as requests for access, and which website or campaign link referred a visit (only that site's domain or the campaign's name), all as daily totals. No cookies, device identifiers or IP addresses are used for this, and if your browser sends Global Privacy Control or Do Not Track we don't count your visit at all.

How your prompts are processed

When you ask Triumvir AI a question, the text you type is sent to Anthropic's API to generate the answer, over an encrypted connection. We send only what is needed to answer you. We do not use your prompts for advertising, and we do not train models on them.

Anthropic, the model provider, states that by default it does not use inputs or outputs from its commercial API to train its models, and that it deletes API inputs and outputs within 30 days. It may keep data longer when needed to enforce its usage policy or to comply with the law. See Anthropic's training policy and retention policy (checked 24 October 2026).

Subprocessors

These companies process data on our behalf to run the service:

• DigitalOcean hosts our servers and database (United States, San Francisco region).
• Anthropic provides the AI model and receives the text of your prompts to answer them.
• Stripe will process payments when paid plans launch. We will never see or store your full card number. Not active yet.
• An email delivery provider will send activation and password-reset emails once it is set up. We will name it here before it is used.

Our domain registrar and our certificate authority (Let's Encrypt) do not receive customer data.

What we do not do

• No advertising, tracking pixels or third-party analytics. This site loads nothing from a third party; even our fonts are served from our own server.
• No selling, renting or sharing of personal data with marketers.
• No marketing email. If you join the waitlist, we email you about access to the service and nothing else.

Security

Connections are encrypted (HTTPS with HSTS). Passwords are stored only as scrypt hashes. Sessions use HttpOnly, Secure cookies with CSRF protection. Rate limits and account lockout protect against guessing. The public service runs on its own host, separate from our internal systems, under a strict Content Security Policy. More detail is on the Technology page.

Delete your data

Signed-in customers can delete their account and all of its data from the account page. This removes your email, password hash, sessions and usage counters immediately. Nightly backups that include your data are kept on our server for 14 days and then deleted.

Leave the waitlist

Enter the email you joined with and we remove it immediately. For privacy, the response is the same whether or not the address was on the list.

Who we are

Triumvir Labs is a venture of Creative Design Workshop, LLC. This page will be updated as the service grows; the date near the top tells you when it last changed. Questions: ops@triumvirlabs.com.